Contents

The best thing to do

Upgrade to the latest stable version of Moodle and use the Security report to analyse your configuration. Then do all the things it tells you.

Note this is not strictly necessary to combat just profile spam (see the critical settings below) but it will protect you against dozens of other known security vulnerabilities.

Critical settings

Make sure that 'register_globals' is switched off in your PHP settings (this is the default). Otherwise your site may be at risk of being cracked, allowing spammers to modify your scripts and insert spam wherever they like.

Add spam protection to the new account form by enabling reCAPTCHA - see Security FAQ for details of how to do so. ReCAPTCHA is quite effective against most automated spambots, but will not foil human spammers at all.

Limit self registration to particular email domains with the allowed email domains setting or deny email addresses from temporary email domains with the denied email domains setting. (Tip: search the Internet for an up-to-date list of domains for disposable and temporary email addresses then copy and paste the whole list into the denied email domains field.) Both settings are in Site administration > Users > Authentication > Manage authentication common settings.

Consider only enabling self registration for a short period of time to allow users to create accounts, and then later disable it by setting 'Self registration' to Disable in the common settings in Site administration > Plugins > Authentication > Manage authentication.

Cleaning up user profile spam

Spam cleaner

If your site was open in the past and you have a spam problem then here are some things you can do to clean up the profiles:

Use our Spam cleaner report in Site administration > Reports > Spam cleaner to locate user accounts responsible for spam and other nasty stuff and help you delete them. In addition to user profile descriptions, comments, blog posts and messages are also searched for keywords.

Browse your user list looking for patterns to detect users who need to be deleted. For example, spammers might have chosen a country that none of your real users has.

Use the delete buttons or the Bulk user actions tool in Site administration > Users > Accounts to find all these users and delete them.